Overview

overview

10

Static

static

1

dridex

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    99a9de7fff6ab1dfbdba48c1b34ec8ae76d026fd8537e61d82272f0f41a9fc0c

  • Size

    342KB

  • Sample

    230328-h6b3rabd3x

  • MD5

    1f891e564214e00de244d744be5d0efd

  • SHA1

    3239c3d31b194db2bb61dcc5787dcaeac7241465

  • SHA256

    99a9de7fff6ab1dfbdba48c1b34ec8ae76d026fd8537e61d82272f0f41a9fc0c

  • SHA512

    32de3fdaeace59f75f15e3ff8da1807272e38319d0856da1a98b437797c0d39e5221056752a60717c2bb9b53ffe9c988196e55f466a93dc3015a0e3ee3dab9f7

  • SSDEEP

    3072:4QPQBoetAz5z/CtBr87vvCaVAUAjx8KTKJETrY5qFdMDYtmQPpoPDa5Bd4IfTIZB:5des5z6tB06Px8BtAtVpwTZB

Score
10/10
rhadamanthyscollectionstealer

Malware Config

Targets

    • Target

      99a9de7fff6ab1dfbdba48c1b34ec8ae76d026fd8537e61d82272f0f41a9fc0c

    • Size

      342KB

    • MD5

      1f891e564214e00de244d744be5d0efd

    • SHA1

      3239c3d31b194db2bb61dcc5787dcaeac7241465

    • SHA256

      99a9de7fff6ab1dfbdba48c1b34ec8ae76d026fd8537e61d82272f0f41a9fc0c

    • SHA512

      32de3fdaeace59f75f15e3ff8da1807272e38319d0856da1a98b437797c0d39e5221056752a60717c2bb9b53ffe9c988196e55f466a93dc3015a0e3ee3dab9f7

    • SSDEEP

      3072:4QPQBoetAz5z/CtBr87vvCaVAUAjx8KTKJETrY5qFdMDYtmQPpoPDa5Bd4IfTIZB:5des5z6tB06Px8BtAtVpwTZB

    Score
    10/10
    rhadamanthyscollectionstealer

    • Detect rhadamanthys stealer shellcode

    • Rhadamanthys

      Rhadamanthys is an info stealer written in C++ first seen in August 2022.

      stealerrhadamanthys

    • Accesses Microsoft Outlook profiles

      collection

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Lateral Movement

Collection

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Tasks